FwpmNetEventEnum2 function (fwpmu.h)

Article
02/22/2024

The FwpmNetEventEnum2 function returns the next page of results from the network event enumerator.

Note FwpmNetEventEnum2 is the specific implementation of FwpmNetEventEnum used in Windows 8 and later. See WFP Version-Independent Names and Targeting Specific Versions of Windows for more information. For Windows 7, FwpmNetEventEnum1 is available. For Windows Vista, FwpmNetEventEnum0 is available.

Syntax

DWORD FwpmNetEventEnum2(
  [in]  HANDLE          engineHandle,
  [in]  HANDLE          enumHandle,
  [in]  UINT32          numEntriesRequested,
  [out] FWPM_NET_EVENT2 ***entries,
  [out] UINT32          *numEntriesReturned
);

Parameters

[in] engineHandle

Type: HANDLE

Handle for an open session to the filter engine. Call FwpmEngineOpen0 to open a session to the filter engine.

[in] enumHandle

Type: HANDLE

Handle for a network event enumeration created by a call to FwpmNetEventCreateEnumHandle0.

[in] numEntriesRequested

Type: UINT32

The number of enumeration entries requested.

[out] entries

Type: FWPM_NET_EVENT2***

Addresses of enumeration entries.

[out] numEntriesReturned

Type: UINT32*

The number of enumeration entries returned.

Return value

Type: DWORD

Return code/value	Description
ERROR_SUCCESS 0	The network events were enumerated successfully.
FWP_E_NET_EVENTS_DISABLED 0x80320013	The collection of network diagnostic events is disabled. Call FwpmEngineSetOption0 to enable it.
*FWP_E_ error code** 0x80320001—0x80320039	A Windows Filtering Platform (WFP) specific error. See WFP Error Codes for details.
*RPC_ error code** 0x80010001—0x80010122	Failure to communicate with the remote or local firewall engine.

Remarks

If the numEntriesReturned is less than the numEntriesRequested, the enumeration is exhausted.

The returned array of entries (but not the individual entries themselves) must be freed by a call to FwpmFreeMemory0.

A subsequent call that uses the same enumHandle parameter will return the next set of events following those in the current entries buffer.

FwpmNetEventEnum2 returns only events that were logged prior to the creation of the enumHandle parameter. See Logging for more information.

Requirements

Requirement	Value
Minimum supported client	Windows 8 [desktop apps only]
Minimum supported server	Windows Server 2012 [desktop apps only]
Target Platform	Windows
Header	fwpmu.h
Library	Fwpuclnt.lib
DLL	Fwpuclnt.dll